diff --git a/src/components/legal/Privacy.tsx b/src/components/legal/Privacy.tsx
index 725e731..70c3930 100644
--- a/src/components/legal/Privacy.tsx
+++ b/src/components/legal/Privacy.tsx
@@ -171,6 +171,11 @@ export function Privacy() {
                     Quality measurements taken from the video file and transcript: length, speaking
                     time and pace, transcription confidence, filler words, resolution and bitrate.
                   </li>
+                  <li>
+                    Three everyday words we show you, chosen at random for each application, that we
+                    ask you to say somewhere in your video.
+                  </li>
+                  <li>The results of the automated checks described below.</li>
                   <li>Our reviewers&rsquo; decision and scores for your application.</li>
                   <li>
                     A record of your consent: the wording version you agreed to, when, and your app
@@ -185,6 +190,39 @@ export function Privacy() {
                   We never sell or share your application with third parties.
                 </p>
               </div>
+              <div>
+                <h4 className="font-bold mb-2">Automated checks</h4>
+                <p className="opacity-70">
+                  We run a few automated checks to help our reviewers. They only mark an application
+                  for a closer look by a person: they never approve or reject anyone, and their
+                  results are not shown to you.
+                </p>
+                <ul className="list-disc list-inside space-y-1 opacity-70 mt-2">
+                  <li>
+                    <strong>Check words:</strong> we check that the three words we showed you are said
+                    in your video, so we know the video was made for this application.
+                  </li>
+                  <li>
+                    <strong>Video content:</strong> Amazon Rekognition looks at the video frames for
+                    prohibited content such as nudity, violence, weapons or drugs. It looks only for
+                    those kinds of content; it does not recognise your face or identity and does not
+                    analyse your appearance, age, emotions or where you are looking.
+                  </li>
+                  <li>
+                    <strong>Spoken content:</strong> we look for scam, money-request or
+                    &ldquo;move off the app&rdquo; phrases in the transcript.
+                  </li>
+                  <li>
+                    <strong>Speaking time and upload timing:</strong> we check there is enough speech
+                    in the video and that it was recorded around the time you applied.
+                  </li>
+                </ul>
+                <p className="opacity-70 mt-2">
+                  The results are kept with your application for the admissions team only, are
+                  deleted with it, and are never used to train Admissions Assist. If a check cannot
+                  run, your application simply goes to a person to review.
+                </p>
+              </div>
               <div>
                 <h4 className="font-bold mb-2">Who sees your application</h4>
                 <p className="opacity-70">
@@ -242,26 +280,28 @@ export function Privacy() {
                     Approved: the video and transcript are deleted 30 days after you use your invite.
                   </li>
                   <li>
-                    Deleting your OneHook account deletes your application, video and transcript.
+                    Deleting your OneHook account deletes your application, video, transcript and
+                    the training records made from your application.
                   </li>
                   <li>
                     The training records derived from your application (transcript text,
                     measurements and decision) are kept while Admissions Assist is in use, unless
-                    you ask us to delete them.
+                    you withdraw your consent or ask us to delete them.
                   </li>
                 </ul>
               </div>
               <div>
                 <h4 className="font-bold mb-2">Withdrawing</h4>
                 <p className="opacity-70">
-                  You can withdraw your application in the app at any time. To withdraw your consent
-                  for Admissions Assist, or to have your training records deleted, email{' '}
+                  You can withdraw your application in the app at any time. To stop your video being
+                  used for Admissions Assist, tap &ldquo;Stop using my video for Admissions
+                  Assist&rdquo; on your application screen: we exclude your data from all future
+                  training and delete the training records made from your application straight
+                  away. Your application itself stays as it is. You can also email{' '}
                   <a href="mailto:privacy@onehook.club" className="text-accent font-mono">
                     privacy@onehook.club
                   </a>{' '}
-                  with the phone number you applied with. We will exclude
-                  your data from all future training and delete your training records within 30
-                  days. A model trained before your request is not changed retroactively, but your
+                  with the phone number you applied with, and we will do the same within 30 days. A model trained before your request is not changed retroactively, but your
                   data is not used in any later training.
                 </p>
               </div>
@@ -269,8 +309,8 @@ export function Privacy() {
                 <h4 className="font-bold mb-2">Where it is stored</h4>
                 <p className="opacity-70">
                   Applications, transcripts and training data are encrypted and stored on Amazon Web
-                  Services in India (Mumbai region). Transcription, SMS and model training also run
-                  on AWS in that region.
+                  Services in India (Mumbai region). Transcription, the automated video content
+                  check, SMS and model training also run on AWS in that region.
                 </p>
               </div>
             </div>
@@ -521,7 +561,8 @@ export function Privacy() {
                 <strong>Email Service:</strong> SNS
               </li>
               <li>
-                <strong>Video Applications:</strong> Amazon Transcribe and Amazon SageMaker, hosted
+                <strong>Video Applications:</strong> Amazon Transcribe, Amazon Rekognition and Amazon
+                SageMaker, hosted
                 in AWS (India region)
               </li>
               <li>